Defence Cyber Certification: the MOD has asked for Level 0 this year.

Get your business ready for DCC. From Cyber Essentials and technical remediation to policies, evidence and assessment preparation, we help you get ready for independent certification. UK-based support, on site across the M4, M3 and A34 corridors when it helps.

Book a DCC readiness call · Not sure which level you need?

Start with Level 0: the MOD has asked for it by 31 December 2026

Level 0 is the floor. It is a valid Cyber Essentials certificate covering the business-critical systems in scope, plus three organisational controls from DEF STAN 05-138.

Where the 31 December 2026 date comes from. It is a request from the Ministry of Defence to its supply chain, not a statutory deadline and not yet a clause in every contract. On 8 May 2026 Eleanor Fairford, the MOD’s Director of Cyber Defence and Risk, wrote on the MOD’s Defence Digital blog: “I have also recently asked all industry partners to achieve Level 0 DCC certification by 31st December 2026”, adding that this “includes a requirement for obtaining Cyber Essentials for all applicable business-critical systems”, and that “where higher levels of certification are required at lower tiers in the supply chain, these should be scheduled for delivery after 31 December 2026”. Source: One year of Defence Cyber Certification, MOD Defence Digital blog, 8 May 2026.

The binding requirement on any given contract remains the Cyber Risk Profile and the Supplier Assurance Questionnaire under DEFCON 658. In practice, the December date is when MOD buyers and prime contractors will expect to see a Level 0 certificate. If you supply the MOD or a prime and hold nothing yet, Level 0 is the place to begin, whatever level your next contract eventually names.

What Level 0 asks of you, in plain terms:

• Cyber Essentials, current and covering the systems the defence work touches
• The three Level 0 controls from the standard, in place and evidenced
• An assessment by an approved DCC certification body, then an annual attestation and re-certification every three years

Level 0 readiness with Nerdster includes:

• Cyber Essentials review or readiness and certification, depending on where you are
• A technical gap check against the Level 0 controls, with fixes carried out where you want us to
• The DCC Level 0 readiness review and a short evidence pack organised the way the certification body expects
• Coordination with your chosen approved DCC certification body and support through the assessment

Get Level 0 ready

What it costs

Four things are priced separately, and we put all four in one written quote so there are no surprises. The ranges below are indicative, drawn from published certification body prices in September 2026; the body you choose sets its own fee.

What	Who charges	Indicative range
Cyber Essentials (the prerequisite for every level)	Nerdster, including the certification fee	From £795 + VAT for a certification review, from £1,495 + VAT for readiness and certification, Plus from £2,995 + VAT
DCC readiness: gap assessment, policies, evidence pack, assessment preparation	Nerdster	Level 0 typically £1,500 to £3,000 + VAT including Cyber Essentials readiness. Level 1 quoted after the gap assessment, so you pay for the gaps you actually have
Technical remediation: MFA, patching, device replacement, licences	Nerdster, quoted per fix	Depends entirely on what the gap assessment finds
Independent assessment and certificate	The DCC certification body, paid to them	Level 0: one body’s published 2026 list runs from £650 + VAT (1 to 9 staff) to £1,000 + VAT (250+ staff) for a three-year certificate. Level 1 and above: set by the body per organisation and considerably higher; we confirm the figure with your chosen body before quoting
Ongoing support (optional)	Nerdster managed service	Quoted monthly; keeps the controls maintained for the annual attestation and the next renewal

Get a written quote

Level 1 and above

Level 1 is where most SME suppliers first feel the difference. Its 101 controls look across the whole organisation, not just the IT estate, and cover:

• Security governance
• Policies and procedures
• Risk management
• Asset management
• User and access controls
• Endpoint security
• Patch management
• Encryption
• Email and network security
• Staff awareness
• Supplier security
• Vulnerability management
• Logging and monitoring
• Incident response
• Business continuity and recovery

Levels 2 and 3 are reserved for high and substantial risk programmes. Both require Cyber Essentials Plus, and both call for more advanced monitoring, resilience and planning. For those levels we work with your internal team and specialist certification partners to identify gaps, implement controls and prepare the organisation for assessment.

DEF STAN 05-138 and DCC: the difference

DEF STAN 05-138 Issue 4, published in May 2024, is the Ministry of Defence’s cyber security standard for its supply chain. It defines the controls for each Cyber Risk Profile: 3 at Level 0, 101 at Level 1, 139 at Level 2 and 144 at Level 3. It is the list of things you must do.

Defence Cyber Certification is the independent certification, run by IASME for the MOD, that proves you do them. Certification is carried out by an approved DCC certification body; Nerdster is not one, which is why our advice is not tied to your assessment result.

Two practical consequences:

• If a tender, contract or prime contractor requirement quotes “DEF STAN 05-138” rather than “DCC”, it is the same set of controls, and DCC certification is the recognised way to evidence them. MOD Industry Security Notice 2026/02 confirms that a valid DCC certificate at or above the level a contract requires is accepted as evidence of the DEF STAN 05-138 controls for that contract, and that a higher certificate satisfies every lower level.
• The Supplier Assurance Questionnaire, completed through the MOD’s Supplier Cyber Protection Service, still has to be submitted. DCC evidences the controls; it does not yet replace the questionnaire.

Not sure which level you need?

You do not need to decode the Defence Standard yourself. For a plain-English walk through the scheme, the MOD’s request and the kinds of business it reaches, read Defence Cyber Certification: who needs it and why.

If an MOD customer, prime contractor or procurement process has given you a Cyber Risk Profile, we review the requirement and explain what it means for your business. If you are preparing ahead of a defence opportunity, we assess your current environment against the appropriate DCC requirements.

Talk to a DCC specialist

From requirement to ready

1. Understand

We review your DCC requirement, Cyber Risk Profile and current cyber security environment. You get a clear explanation of what applies to your organisation.

2. Assess

We compare your existing security against the required controls. Already have Cyber Essentials, ISO 27001, Microsoft 365, Intune or other controls in place? We identify what can be reused and where the real gaps are.

3. Fix

We help implement what is missing. That can include policies and procedures, Microsoft 365 security, Intune and endpoint management, MFA and identity security, access controls, device configuration, patch management, EDR and malware protection, firewalls and network security, encryption, backups and recovery, logging and monitoring, and incident response.

4. Evidence

Having security controls is not enough if you cannot demonstrate them. We build an organised evidence pack showing how each control is implemented and managed.

5. Prepare

Before independent assessment, we work through outstanding issues and help your team prepare for the certification process.

6. Maintain

Cyber compliance is not a once-a-year scramble. Nerdster can continue managing your IT, cyber security, monitoring, policies and evidence so your environment stays ready for the annual attestation.

Already have Cyber Essentials?

Good. You already hold part of the foundation, and at Level 0 most of it. Above that, DCC asks about how the whole business runs its security: who owns risk, how suppliers are vetted, what happens when something goes wrong. Nerdster helps bridge that gap.

1. Cyber Essentials. Basic technical cyber hygiene. See our Cyber Essentials packages.
2. DCC readiness. Technology, people, processes, policies, evidence and resilience.
3. Independent DCC assessment. Assessment and certification through an approved DCC certification body licensed by IASME.

What you get

• DCC gap assessment. A structured review against the controls applicable to your required DCC level.
• Readiness score. Where you are today, what is already covered and what still needs attention.
• Remediation plan. A prioritised action plan instead of a 100-page compliance document nobody understands.
• Technical implementation. Where required, Nerdster implements and manages the underlying security technology.
• Policies and procedures. The governance and operating procedures the controls call for.
• Evidence pack. Evidence organised against the relevant controls, ready for assessment preparation.
• Certification support. We work alongside your chosen independent DCC certification body through the certification process.
• Ongoing management. Your security controls kept maintained after certification.

Already using Microsoft 365?

You may be closer than you think. For many SMEs, capabilities already available within Microsoft 365, Entra and Intune contribute to identity, MFA, device management, access control, security configuration, endpoint protection, logging and data protection.

The challenge is configuring them correctly, documenting them and filling the gaps around them. That is where Nerdster comes in. See our Microsoft 365 support.

Renewal and ongoing obligations

Certification is not the end of it. Plan for these from the start:

• DCC certificates last three years, with an annual attestation in between to confirm the controls are still in place.
• The Supplier Assurance Questionnaire is reviewed annually on the contract anniversary under DEFCON 658, and the Cyber Risk Profile can be reset at that point, which can change the level you need.
• Cyber Essentials renews every 12 months and must stay valid throughout. Levels 2 and 3 need a valid Cyber Essentials Plus for the whole certification period.
• New and renewed MOD contracts carry the requirement. Cyber Security Model version 4 went live in October 2025 and has applied to new risk assessments and questionnaires since 3 December 2025, so a renewal is where most suppliers first meet it.

Nerdster’s optional managed service keeps the controls maintained so each of these is routine rather than a project.

Official sources

• MOD guidance: Cyber Security Model on GOV.UK, including the Supplier Assurance Questionnaire process.
• Industry Security Notice 2025/07: implementation of Cyber Security Model version 4 from 3 December 2025 and the annual questionnaire review.
• Industry Security Notice 2026/02: use of DCC as assurance of the DEF STAN 05-138 controls under DEFCON 658.
• The 31 December 2026 date: One year of Defence Cyber Certification, MOD Defence Digital blog, including the request that industry partners reach Level 0 by 31 December 2026.
• IASME: launch of the Defence Cyber Certification scheme, the scheme owner and certification authority.

Built for SMEs in the defence supply chain

You should not need a full-time compliance department just to understand what your MOD customer is asking for. Nerdster combines IT, cyber security and practical compliance implementation into one service, and focuses on getting the controls working in the real business, not on producing policies for a folder.

• We implement the changes ourselves rather than handing you a list of what is wrong.
• You always know what is complete, what is missing and what happens next.
• If you want, we keep running the underlying security controls after the project finishes.
• Support comes from a UK technology and cyber security team.

Do not wait for a defence opportunity to expose the gaps

Whether you have already been given a DCC requirement or simply want to become ready to supply the defence sector, we will show you where you stand and what needs to happen next. Start with a DCC readiness review: understand your current position, identify the gaps and build a clear route to certification.

Book your DCC readiness call